~ / search / GHSA-8rmm-gm28-pj8q

GHSA-8rmm-gm28-pj8q

Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-6717

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 22.0.10 22.0.10
Maven org.keycloak:keycloak-services >= 23.0.0, < 24.0.3 24.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:). Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. #### Acknowledgements: Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.

References

External links from the advisory. They lead to third-party sites.